MSCI (MSCI) Risk Analysis

A material portion of our revenues is concentrated in some of our largest clients. For the fiscal year ended December 31, 2025, our largest client organization by revenue, BlackRock, accounted for 10.8% of our consolidated operating revenues. For the fiscal year ended December 31, 2024, our largest client organization by revenue, BlackRock accounted for 10.2% of our consolidated operating revenues. Our revenue growth depends on our ability to obtain new clients, quickly onboard our clients and deploy our products and services to them, sell additional services to existing clients and achieve, maintain or improve pricing structures and sustain a high level of renewal rates with respect to our existing licenses. Failure to achieve one or more of these objectives could have a material adverse effect on our business, financial condition or results of operations. A client's activity with us may decrease for a variety of reasons, including the client's level of satisfaction with our products and services; the effectiveness of our support services; the pricing of our products and services; the pricing and quality of competing products or services; client events such as mergers, acquisitions, restructurings, or business closures; or the effects of changes in economic conditions and the global capital markets. In addition, demand for our products may be impacted by cyclical market changes, regulatory uncertainty and political scrutiny, which could negatively affect client adoption and our financial performance. If we experience significant cancellations or reductions in licenses, either individually or in the aggregate, and we are unsuccessful in replacing those licenses, our business, financial condition or results of operations could be materially adversely affected.

We rely on open source code to develop software and to incorporate it in our products and internal systems. The use of open source code may entail greater risks than third-party commercial software, as open source licensors generally do not provide warranties or other protections regarding infringement claims, the quality of the code or the security of the code. Certain open source licenses provide that if we combine our proprietary code with open source code and distribute it in a certain manner, we could be required to release the source code to the public, potentially allowing our competitors to create similar products and putting us at a competitive disadvantage. Additionally, the terms of many open source code licenses are ambiguous and have not been interpreted by U.S. courts, increasing the risk of unanticipated restrictions or conditions on our use of such software. Therefore, we could be required to seek licenses from third parties on terms that are not commercially feasible, to make portions of our proprietary code publicly available to re-engineer our products or systems, to discontinue licensing certain products, or to take other remedial action that could divert resources. We could also be subject to suits by parties claiming breach of the terms of licenses, which could be costly for us to defend. Open source code may also contain security vulnerabilities or malicious code (including backdoors), which could impair our products or systems, reduce client confidence, harm our reputation and expose us to litigation or other liability. Any of these factors could materially adversely affect our business, financial condition or results of operations.

Failure to comply with any applicable laws, rules, regulations, executive or administrative orders or other governmental requirements, or industry codes of conduct, could subject us to litigation, regulatory actions, sanctions, fines or other penalties, as well as damage our brand and reputation. The financial services industry, within which we and many of our clients operate, is subject to extensive laws, rules and regulations, with direct regulation of certain of our products in some jurisdictions. These laws, rules and regulations are complex, evolve frequently and sometimes quickly and unexpectedly, and are subject to administrative interpretation and judicial construction in ways that are difficult to predict, and could materially adversely affect our business or our clients' businesses. Additionally, we may be required to comply with multiple and potentially conflicting laws, rules or regulations in various jurisdictions, which could, individually or in the aggregate, result in materially higher compliance costs to us. Laws, rules or regulations could require changes to the way we license and price our products and services. In addition, various government and regulatory bodies from time to time may make inquiries and conduct investigations into our compliance with applicable laws and regulations and our business practices, including those related to our regulated activities and other matters. Changes to the laws, rules and regulations applicable to our clients could limit our clients' ability to use our products and services or could otherwise impact our clients' demand for our products and services. As such, to the extent our clients become subject to certain laws, rules or regulations, we may incur higher costs in connection with modifying our products or services. If laws, rules or regulations place new obligations on clients that affect us, restrict our clients' or vendors' ability or willingness to provide data to us, or impose new compliance obligations or restrictions on how we access and use such data, our ability to continue to produce products and services, or the costs associated with doing so, could be negatively affected. The regulations and regulatory considerations that most significantly impact us are described below: - Benchmarks. Compliance with regulations affecting benchmarks or their uses, as well as related technical standards and guidance, could negatively impact our business and results of operations. Benchmarks, which include the indexes we provide, are subject to regulations that may require changes in our business practices, product offerings or our ability to offer indexes in certain jurisdictions. Such impacts could include, without limitation, increased costs, including direct regulatory fees and costs; diminished intellectual property rights; methodology requirements or restrictions; product requirements or restrictions; constraints on the fees we charge; constraints on our ability to meet contractual commitments with data providers; or constraints on how we offer our products. Any of these factors could have a material adverse effect on our index products. For example, the EU Benchmark Regulation ("EU BMR") and UK Benchmarks Regulation ("UK BMR") impose distinct requirements. Following Brexit, the EU BMR provided a transition period until December 31, 2025, allowing EU-regulated entities to use benchmarks from non-EU administrators. Beginning January 1, 2026, most of our indexes fall outside EU supervision and remain under UK oversight. For indexes that remain subject to EU regulation, ESMA's supervision may result in additional compliance obligations for our business. The UK BMR transition period for non-UK administrators continues until December 31, 2030. In December 2025, the UK HM Treasury launched a consultation on proposals to amend the scope of the UK BMR. Depending on the outcome, these changes could affect the regulatory status of certain of our benchmarks, alter our compliance obligations or impact our ability to offer certain products to UK-regulated clients. Diverging interpretations or future amendments to these regulations may also increase compliance burdens and operational complexity. Additionally, guidance issued by the European Securities and Markets Authority ("ESMA") may affect benchmark administrators and their clients. For instance, the ESMA Guidelines on ETFs and other Undertakings for Collective Investment in Transferable Securities ("UCITS") Issues impose disclosure requirements for indexes used in UCITS funds, such as making index constituents and their respective weightings easily accessible free of charge to investors on a delayed and periodic basis. These requirements could increase the compliance obligations for benchmark administrators, affect the eligibility of certain indexes for use in UCITS funds and influence the demand for specific products. Globally, the benchmark industry faces heightened scrutiny and potential new regulations. The International Organization of Securities Commissions (IOSCO) has recommended that benchmark administrators voluntarily publicly disclose whether they comply with its principles for financial benchmarks. Other jurisdictions have also indicated they may consider potential benchmark regulation or conduct reviews of the benchmark industry. For instance, regulation is being considered or developed in South Africa. Heightened scrutiny and regulatory attention on benchmarks and index providers from regulators, policymakers, and the media in the EU, U.S., and other regions could result in negative publicity or comments about the role or influence of our company or the index industry, which could harm our reputation and credibility. For example, in the past we have made changes or announced proposed changes to our index methodologies that have triggered media and policymaker attention. Further, laws, rules or regulations affecting users of our indexes, such as sanctions that prohibit users of our indexes from investing or transacting in markets or securities included in our indexes, can have an indirect impact on our indexes, including their construction and composition. - ESG Ratings. The EU has adopted a new regulation requiring market participants providing ESG ratings in the EU to become authorized and supervised by ESMA. The regulation becomes effective in July 2026 and imposes requirements relating to governance, conflicts of interest, transparency of methodologies and ongoing supervisory obligations. Certain of our Sustainability and Climate products are expected to be in scope. We may incur significant costs to achieve and maintain authorization, modify our operations or product offerings and comply with ongoing supervisory requirements. - The UK has adopted separate legislation to regulate ESG ratings providers beginning in June 2028, the requirements of which are still being developed. A number of other jurisdictions, including Japan, Hong Kong SAR, Taiwan, India and Singapore, have completed, or are in the process of developing, legislation or codes of conduct for ESG rating or data providers. Regulation of ESG ratings and data providers could impose significant compliance burdens and costs on our Sustainability and Climate products and services. Furthermore, the potential for inconsistent or conflicting requirements across jurisdictions may create implementation challenges, increase compliance risks and result in inadvertent noncompliance, which could materially impact our operations and reputation. - Data Privacy and AI. Laws, rules, regulations and standards governing privacy, data collection and AI impact our ability to collect, manage, store, use and otherwise process personal data and other information. We operate across jurisdictions with differing and often conflicting data privacy laws, including extraterritorial requirements, which continue to expand in scope and complexity. Compliance with these laws requires significant resources to ensure data security and regulatory adherence. Furthermore, we frequently have privacy compliance requirements as a result of our contractual obligations with counterparties. Emerging AI regulations, such as the European Union's Artificial Intelligence Act, impose requirements for transparency, fairness and oversight of AI systems. These regulations may directly affect our operations, including the use of AI in hiring, employee performance monitoring and client-facing applications, by requiring audits, documentation and human oversight. Compliance with evolving AI regulatory frameworks may increase costs, impact our product development, restrict the use of certain applications of AI and expose us to liability for violations of applicable laws, regulations or contracts. - Advisory Services. Regulators have examined the role of various types of third-party information providers, including index and model providers and proxy advisors, in the asset-management ecosystem. Regulatory or legislative developments that expand or alter the definition of investment advice, proxy advice, or that subject index providers, model providers or ESG ratings providers to fiduciary or adviser-style obligations, could affect our businesses. For instance, in the United States, the SEC has previously sought public comment on the role of index providers and whether they are acting as investment advisers under the Investment Advisers Act. If any of our businesses were deemed to be providing investment advice or otherwise to have fiduciary or adviser-style obligations, this could significantly increase the costs and complexity of our business and potentially conflict with obligations under other regulations. Our ability to comply with applicable laws and regulations depends on maintaining an effective compliance program, which can be time-consuming and costly, as well as on our ability to attract and retain qualified compliance personnel. In some instances, in connection with the provision of data and services, we have incurred additional costs to implement processes and systems at the request of our clients to ensure their use of our data complies with applicable regulations. U.S. Executive Orders and related agency directives may also indirectly influence client mandates and market accessibility, require rapid adjustments and result in additional compliance obligations for our business. For example, a U.S. Executive Order prohibiting many of our clients from transacting in the securities of certain Chinese companies resulted in our decision to remove these companies from relevant indexes to support our clients' needs for indexes to be replicable in investment portfolios. To the extent that our clients are subject to increased requirements or regulation, we may be indirectly impacted, leading to lower revenues or higher costs that could reduce the profitability of certain products or services. Because the financial services industry is highly regulated, we could become subject to other existing or new regulatory frameworks in the jurisdictions where we operate, which could increase our costs and risks, require changes to our products and services, or otherwise impact our business. Additionally, there has been increased attention on and scrutiny of index providers and ESG ratings and data providers by politicians, regulators, policymakers and the media. This heightened attention may result in new or expanded regulations, investigations or other regulatory actions, which could increase compliance costs, impose operational constraints, or otherwise materially adversely affect our business, financial condition, or results of operations.